Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Internet Explorer öffnet automatisch Werbung (https://www.trojaner-board.de/93690-internet-explorer-oeffnet-automatisch-werbung.html)

craep 12.12.2010 13:32
Internet Explorer öffnet automatisch Werbung
 
Hallo.
Seit einigen Tagen öffnet sich alle paar Minuten ein Internet Explorer mit Werbung (ich benutze aber Firefox als Standartbrowser). Ich habe hier schon verschiedenes über das selbe Problem gelesen, aber man soll ja immer einen neuen Thread aufmachen...
Mein Virenprogramm (Avira AntiVir Free 10) hat nichts gefunden, es kann allerdings sein, dass ich mir das Ding ausversehen "absichtlich" installiert habe.
Ich benutze Windows 7 64Bit, und das hat HiJackThis ausgspuckt:

Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:23:39, on 12.12.2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe
C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe
C:\Program Files (x86)\FeedDemon\FeedDemon.exe
C:\Program Files (x86)\Pidgin\pidgin.exe
C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Christoph\AppData\Local\Temp\Rnv.exe
C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\HiJackThis\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer bereitgestellt von ARLT Computer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O2 - BHO: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Lexmark  - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [FeedDemon] "C:\Program Files (x86)\FeedDemon\FeedDemon.exe" /startminimized
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [Pidgin] C:\Program Files (x86)\Pidgin\pidgin.exe
O4 - HKCU\..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O8 - Extra context menu item: Add to &Evernote - res://C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll/2000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
O9 - Extra 'Tools' menuitem: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: lxebCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe
O23 - Service: lxeb_device -  - C:\Windows\system32\lxebcoms.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Druckwarteschlange (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TabletServicePen - Unknown owner - C:\Windows\system32\Pen_Tablet.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: WTouch Service (WTouchService) - Wacom Technology, Corp. - C:\Program Files\WTouch\WTouchService.exe

--
End of file - 10904 bytes
Ich hoffe ihr könnt mir helfen!

Craep

P.S.:
In meiner Hosts Datei steht unter anderem folgendes:
127.0.0.1 im.adtech.de
127.0.0.1 adserver.adtech.de
127.0.0.1 adtech.de
127.0.0.1 atwola.com

Vielleicht hat das etwas damit zu tun...

Ach ja, außerdem werd ich, wenn ich ein Video im Vollbild Modus angucke (egal ob mit VLC oder auf YouTube) ca. alle 20 Sekunden "rausgeworfen" und wenn ich auch Websites in ein Textfeld schreibe (wie jetz) wird der Fokus vom Textfeld genommen...

markusg 12.12.2010 13:39
1. nimm keinerlei reinigung selbstständig vor, sonst ist das nur störend.
2. reiche alle evtl vorhandenen scan logs nach. ootl:
3.
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt

craep 12.12.2010 14:07
ICh hab den Scan ausversehen nur von einm Adminkonto aus gemacht, nicht ausdrücklich als Admin gestartet, ich hoffe das macht nichts aus, falls doch mach ich natürlich noch einen!

OTL:
Code:
OTL logfile created on: 12.12.2010 13:51:25 - Run 1
OTL by OldTimer - Version 3.2.17.3    Folder = C:\Users\Christoph\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
8,00 Gb Paging File | 6,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,75 Gb Total Space | 240,58 Gb Free Space | 51,65% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 27,28 Gb Free Space | 11,72% Space Free | Partition Type: NTFS
Drive F: | 180,37 Gb Total Space | 136,02 Gb Free Space | 75,41% Space Free | Partition Type: NTFS
 
Computer Name: CHRISTOPH-PC | User Name: Christoph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Christoph\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe ()
PRC - C:\Users\Christoph\AppData\Local\Temp\Rnv.exe ()
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\FeedDemon\FeedDemon.exe (NewsGator Technologies, Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Pidgin\pidgin.exe (The Pidgin developer community)
PRC - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe ()
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe ()
PRC - C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Christoph\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (lxeb_device) -- C:\Windows\SysNative\lxebcoms.exe ( )
SRV:64bit: - (lxebCATSCustConnectService) -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxebserv.exe ()
SRV:64bit: - (TabletServicePen) -- C:\Windows\SysNative\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (lxeb_device) -- C:\Windows\SysWow64\lxebcoms.exe ( )
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (WTouchService) -- C:\Programme\WTouch\WTouchService.exe (Wacom Technology, Corp.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (MSSQL$SONY_MEDIAMGR) -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$SONY_MEDIAMGR) -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (VMnetAdapter) -- C:\Windows\SysNative\DRIVERS\vmnetadapter.sys File not found
DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\Drivers\TFsExDisk.sys File not found
DRV:64bit: - (nmserial) -- C:\Windows\SysNative\DRIVERS\nmserial.sys File not found
DRV:64bit: - (NmPar) -- C:\Windows\SysNative\DRIVERS\NmPar.sys File not found
DRV:64bit: - (limsgt) -- C:\Windows\SysNative\DRIVERS\limsgt.sys File not found
DRV:64bit: - (athsgt) -- C:\Windows\SysNative\DRIVERS\athsgt.sys File not found
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Sun Microsystems, Inc.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (NEC Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (NEC Electronics Corporation)
DRV:64bit: - (RT73) -- C:\Windows\SysNative\drivers\rt73.sys (Ralink Technology, Corp.)
DRV:64bit: - (nvamacpi) -- C:\Windows\SysNative\drivers\nvamacpi.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (wacomvhid) -- C:\Windows\SysNative\drivers\wacomvhid.sys (Wacom Technology)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV:64bit: - (wacmoumonitor) -- C:\Windows\SysNative\drivers\wacmoumonitor.sys (Wacom Technology)
DRV:64bit: - (ahcix64s) -- C:\Windows\SysNative\drivers\ahcix64s.sys (AMD Technologies Inc.)
DRV:64bit: - (PciIsaSerial) -- C:\Windows\SysNative\drivers\PciIsaSerial.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (PciPPorts) -- C:\Windows\SysNative\drivers\PciPPorts.sys ()
DRV:64bit: - (PciSPorts) -- C:\Windows\SysNative\drivers\PciSPorts.sys ()
DRV:64bit: - (SPorts) -- C:\Windows\SysNative\drivers\SPorts.sys ()
DRV:64bit: - (PPorts) -- C:\Windows\SysNative\drivers\PPorts.sys ()
DRV:64bit: - (ISASerial) -- C:\Windows\SysNative\drivers\ISASerial.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (amdide64) -- C:\Windows\SysNative\drivers\amdide64.sys (Advanced Micro Devices)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (wacommousefilter) -- C:\Windows\SysNative\drivers\wacommousefilter.sys (Wacom Technology)
DRV:64bit: - (WacomVKHid) -- C:\Windows\SysNative\drivers\WacomVKHid.sys (Wacom Technology)
DRV:64bit: - (SynasUSB) -- C:\Windows\SysNative\drivers\synUSB64.sys (SIA Syncrosoft)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc)
DRV - (athsgt) -- C:\Windows\SysWOW64\drivers\athsgt.sys ()
DRV - (limsgt) -- C:\Windows\SysWOW64\drivers\limsgt.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 40 25 5A 5A 33 96 CA 01  [binary data]
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.de/search?q="
FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.wisedock.de/m.php?id=3864ae9136fc9f501194544ec2372e288d51"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.2
FF - prefs.js..extensions.enabledItems: apptabs@frankyan.com:0.6.2
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:2.23b2
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.0
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe41}:1.0.9
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.11
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: StrataBuddy@ReduxTeam:0.6.2
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11
FF - prefs.js..extensions.enabledItems: tabprogressbar@studio17.wordpress.com:0.6
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.48.3
FF - prefs.js..extensions.enabledItems: SkipScreen@SkipScreen:0.5.17s
FF - prefs.js..extensions.enabledItems: yawr@sdx.hu:1.21
FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:4.0.0.106602
FF - prefs.js..extensions.enabledItems: pastebin.com@gmail.com:2.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {6AC85730-7D0F-4de0-B3FA-21142DD85326}:2.2.2
FF - prefs.js..extensions.enabledItems: firegestures@xuldev.org:1.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: https-everywhere@eff.org:0.9.2
FF - prefs.js..extensions.enabledItems: Strata40@SpewBoy.au:0.6.2
FF - prefs.js..extensions.enabledItems: chromifox@altmusictv.com:3.6.5
FF - prefs.js..keyword.URL: "hxxp://www.google.de/search?q="
FF - prefs.js..network.proxy.backup.ftp: "193.174.155.26"
FF - prefs.js..network.proxy.backup.ftp_port: 3124
FF - prefs.js..network.proxy.backup.gopher: "193.174.155.26"
FF - prefs.js..network.proxy.backup.gopher_port: 3124
FF - prefs.js..network.proxy.backup.socks: "193.174.155.26"
FF - prefs.js..network.proxy.backup.socks_port: 3124
FF - prefs.js..network.proxy.backup.ssl: "193.174.155.26"
FF - prefs.js..network.proxy.backup.ssl_port: 3124
FF - prefs.js..network.proxy.ftp: "193.174.155.26"
FF - prefs.js..network.proxy.ftp_port: 3124
FF - prefs.js..network.proxy.gopher: "193.174.155.26"
FF - prefs.js..network.proxy.gopher_port: 3124
FF - prefs.js..network.proxy.http: "193.174.155.26"
FF - prefs.js..network.proxy.http_port: 3124
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "193.174.155.26"
FF - prefs.js..network.proxy.socks_port: 3124
FF - prefs.js..network.proxy.ssl: "193.174.155.26"
FF - prefs.js..network.proxy.ssl_port: 3124
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.08.01 14:13:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.12 13:24:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.11 10:13:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.10.28 14:40:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2010.09.27 15:54:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions
[2010.02.14 11:38:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.09.27 15:54:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions\xulapp@opencube.com
[2010.12.12 13:26:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\3bk2ttqa.Entwicklung\extensions
[2010.12.11 11:42:05 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\3bk2ttqa.Entwicklung\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.12.12 13:08:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions
[2010.03.26 12:42:16 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010.11.09 19:05:27 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010.01.21 19:35:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe41}
[2010.01.02 21:00:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{24d1fe20-76df-11de-8a39-0800200c9a66}
[2010.08.20 21:17:15 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010.09.11 15:27:12 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2010.11.12 23:47:50 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010.01.02 19:01:10 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2010.12.10 22:34:59 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.07.30 11:30:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2010.10.26 19:39:34 | 000,000,000 | ---D | M] (Evernote Web Clipper) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2010.04.10 10:54:59 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.01.21 19:08:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\apptabs@frankyan.com
[2010.09.21 20:48:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com
[2010.03.11 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\chromifox@altmusictv.com
[2010.07.20 17:16:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\fastdial@telega.phpnet.us
[2010.11.30 17:43:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firebug@software.joehewitt.com
[2010.12.02 16:12:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firegestures@xuldev.org
[2010.11.26 22:59:33 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\https-everywhere@eff.org
[2010.08.22 22:15:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\pastebin.com@gmail.com
[2010.12.04 11:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\SkipScreen@SkipScreen
[2010.04.21 11:14:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au
[2010.04.15 19:26:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam
[2010.01.21 19:35:30 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\tabprogressbar@studio17.wordpress.com
[2010.04.04 22:26:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\yawr@sdx.hu
[2010.04.21 11:14:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au\chrome\mozapps\extensions
[2010.10.13 19:28:25 | 000,001,998 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\grooveshark.xml
[2010.10.13 19:29:01 | 000,001,330 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\wikipedia-en.xml
[2010.11.21 21:20:25 | 000,001,334 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\wiktionary-de.xml
[2010.10.13 19:24:01 | 000,004,140 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\youtube.xml
[2010.11.15 14:15:49 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.08.23 12:05:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.15 14:15:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.03.27 17:06:04 | 000,067,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npContribute.dll
[2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.07.12 17:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2009.10.26 15:53:52 | 000,102,400 | ---- | M] (Zylom) -- C:\Program Files (x86)\mozilla firefox\plugins\npzylomgamesplayer.dll
[2010.10.24 12:35:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.10.24 12:35:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.10.24 12:35:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.10.24 12:35:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.10.24 12:35:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.08.02 11:47:25 | 000,001,028 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 im.adtech.de
O1 - Hosts: 127.0.0.1 adserver.adtech.de
O1 - Hosts: 127.0.0.1 adtech.de
O1 - Hosts: 127.0.0.1 atwola.com
O1 - Hosts: 127.0.0.1 adserver.71i.de
O1 - Hosts: 127.0.0.1 adicqserver.71i.de
O1 - Hosts: 127.0.0.1 71i.de
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Programme\Lexmark Printable Web\bho.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe ()
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [lxebmon.exe] C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [FeedDemon] C:\Program Files (x86)\FeedDemon\FeedDemon.exe (NewsGator Technologies, Inc.)
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ6.5\ICQ.exe File not found
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe ()
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [Pidgin] C:\Program Files (x86)\Pidgin\pidgin.exe (The Pidgin developer community)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O8:64bit: - Extra context menu item: Add to &Evernote - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: Add to &Evernote - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\WB: DllName - Reg Error: Key error. - C:\PROGRA~2\Stardock\OBJECT~1\WINDOW~1\fast64.dll File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
MsConfig:64bit - StartUpReg: AdobeCS5ServiceManager - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Bamboo Dock - hkey= - key= - C:\Program Files (x86)\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe ()
MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/)
Drivers32: VIDC.CFHD - C:\Windows\SysWow64\cfhd.dll (CineForm Inc.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.12 13:50:12 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe
[2010.12.12 13:19:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HiJackThis
[2010.12.09 22:21:34 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.11.27 15:35:37 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Tropico 3
[2010.11.26 23:31:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MockFlow
[2010.11.26 22:14:14 | 000,000,000 | ---D | C] -- C:\ProgramData\WorldWindData
[2010.11.23 15:12:43 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\sun
[2010.11.16 18:45:38 | 000,836,608 | ---- | C] ( ) -- C:\Windows\SysNative\lxebcoin.dll
[2010.11.15 14:15:48 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2010.11.15 14:15:48 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2010.11.15 14:15:48 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2010.11.14 20:19:23 | 000,905,728 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysNative\synsoacc.dll
[2010.11.14 20:19:16 | 000,031,248 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysNative\drivers\synUSB64.sys
[2010.11.14 20:19:15 | 000,045,056 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\Synsopos.exe
[2010.11.14 20:19:13 | 000,401,462 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\temp.000
[2010.11.14 20:19:08 | 000,757,760 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\SYNSOACC.dll
[2010.11.14 20:19:08 | 000,147,456 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\SynsoLChk.dll
[2010.11.14 20:19:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Syncrosoft
[2010.11.14 20:16:27 | 000,000,000 | ---D | C] -- C:\Install
[2010.11.13 18:17:27 | 000,000,000 | ---D | C] -- C:\Programme\Blender
[2010.06.01 17:23:13 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebinpa.dll
[2010.06.01 17:23:12 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebiesc.dll
[2010.06.01 17:23:11 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebpmui.dll
[2010.06.01 17:23:10 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebserv.dll
[2010.06.01 17:23:10 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebusb1.dll
[2010.06.01 17:23:10 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeblmpm.dll
[2010.06.01 17:23:09 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebhbn3.dll
[2010.06.01 17:23:08 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebcomc.dll
[2010.06.01 17:23:08 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebcomm.dll
[4 C:\Windows\Fonts\*.tmp files -> C:\Windows\Fonts\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010.12.12 13:50:15 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe
[2010.12.12 13:48:00 | 000,001,134 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000UA.job
[2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.12.12 13:19:00 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.12.12 13:05:13 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.12 13:05:13 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.12 12:56:07 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.12 12:55:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.12 12:55:21 | 3214,237,696 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.11 19:00:38 | 000,001,082 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000Core.job
[2010.12.09 22:03:24 | 000,001,239 | ---- | M] () -- C:\Users\Christoph\Desktop\Zwischenlagerung.lnk
[2010.12.09 20:07:19 | 001,550,914 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.12.09 20:07:19 | 000,671,758 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.12.09 20:07:19 | 000,633,640 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.12.09 20:07:19 | 000,137,484 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.12.09 20:07:19 | 000,113,874 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.12.08 14:51:41 | 007,413,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.12.03 23:53:29 | 000,005,990 | ---- | M] () -- C:\Users\Christoph\.recently-used.xbel
[2010.11.26 23:31:04 | 000,000,871 | ---- | M] () -- C:\Users\Public\Desktop\MockFlow.lnk
[2010.11.22 14:17:01 | 000,083,120 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2010.11.16 21:07:36 | 000,215,016 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2010.11.16 21:07:36 | 000,215,016 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010.11.16 18:46:50 | 000,226,478 | ---- | M] () -- C:\Windows\SysNative\LexFiles.ulf
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.10 22:40:53 | 000,000,300 | -H-- | C] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010.12.10 22:40:49 | 000,000,302 | -H-- | C] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.12.10 22:40:46 | 000,000,300 | -H-- | C] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.12.09 22:03:24 | 000,001,239 | ---- | C] () -- C:\Users\Christoph\Desktop\Zwischenlagerung.lnk
[2010.12.03 23:53:29 | 000,005,990 | ---- | C] () -- C:\Users\Christoph\.recently-used.xbel
[2010.11.16 18:45:41 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\lxebsmr.dll
[2010.11.16 18:45:41 | 000,024,064 | ---- | C] () -- C:\Windows\SysNative\lxebsmr.dll
[2010.11.16 18:45:37 | 000,450,048 | ---- | C] () -- C:\Windows\SysNative\lxebins.dll
[2010.11.16 18:45:37 | 000,399,360 | ---- | C] () -- C:\Windows\SysNative\lxebcui.dll
[2010.11.16 18:45:37 | 000,378,368 | ---- | C] () -- C:\Windows\SysNative\lxebcu.dll
[2010.11.16 18:45:37 | 000,245,248 | ---- | C] () -- C:\Windows\SysNative\lxebinsb.dll
[2010.11.16 18:45:37 | 000,148,480 | ---- | C] () -- C:\Windows\SysNative\lxebcuir.dll
[2010.11.16 18:45:37 | 000,065,536 | ---- | C] () -- C:\Windows\SysNative\lxebgcfg.dll
[2010.11.14 20:19:23 | 000,147,425 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Aide.chm
[2010.11.14 20:19:23 | 000,120,468 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Hilfe.chm
[2010.11.14 20:19:23 | 000,114,279 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Help.chm
[2010.11.14 20:19:22 | 000,147,425 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Aide.chm
[2010.11.14 20:19:22 | 000,120,468 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Hilfe.chm
[2010.11.14 20:19:22 | 000,114,279 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Help.chm
[2010.10.31 18:42:32 | 000,000,016 | ---- | C] () -- C:\Windows\SysWow64\msvcsv60.dll
[2010.07.19 19:23:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\LxWbGwLog.log
[2010.07.19 19:23:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\cmn_upld.log
[2010.07.18 19:09:49 | 000,819,200 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.07.18 19:09:48 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.06.24 15:58:17 | 001,508,283 | ---- | C] () -- C:\Program Files (x86)\Euthymia Electronic Organ V2.dll
[2010.06.19 14:20:18 | 000,013,256 | ---- | C] () -- C:\ProgramData\lxebJSW.log
[2010.06.01 22:48:18 | 000,000,000 | ---- | C] () -- C:\Users\Christoph\AppData\Local\eab2d51e-4aba-4bfa-b171-72e2c2a32088
[2010.06.01 17:47:11 | 000,000,675 | ---- | C] () -- C:\ProgramData\lxebDiagnostics.log
[2010.06.01 17:28:38 | 000,000,252 | ---- | C] () -- C:\ProgramData\FastPics.log
[2010.06.01 17:27:23 | 000,000,394 | ---- | C] () -- C:\ProgramData\lxeb.log
[2010.06.01 17:25:02 | 000,026,813 | ---- | C] () -- C:\ProgramData\lxebscan.log
[2010.06.01 17:23:13 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxebcomx.dll
[2010.06.01 17:23:13 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXEBinst.dll
[2010.06.01 17:23:12 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxebinsr.dll
[2010.06.01 17:23:12 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxebjswr.dll
[2010.06.01 17:23:11 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxebins.dll
[2010.06.01 17:23:11 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxebinsb.dll
[2010.06.01 17:23:11 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxebcur.dll
[2010.06.01 17:23:10 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxebcu.dll
[2010.06.01 17:23:10 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxebcub.dll
[2010.06.01 17:22:32 | 000,000,000 | ---- | C] () -- C:\ProgramData\UpdaterLog.txt
[2010.06.01 17:22:21 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXEBsm.dll
[2010.05.05 14:04:09 | 000,000,031 | ---- | C] () -- C:\Windows\SysWow64\m12vt4osini.dll
[2010.04.27 20:49:19 | 000,007,597 | ---- | C] () -- C:\Users\Christoph\AppData\Local\resmon.resmoncfg
[2010.04.18 21:47:31 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\NSREG.DLL
[2010.04.09 18:48:18 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2010.03.15 11:53:09 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.02.04 21:30:19 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2010.02.04 21:30:19 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2010.02.04 21:30:18 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2010.02.03 19:10:53 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.01.03 11:08:43 | 000,000,031 | ---- | C] () -- C:\Windows\iexplore.ini
[2009.12.30 19:32:27 | 000,164,992 | ---- | C] () -- C:\Windows\SysWow64\drivers\athsgt.sys
[2009.12.30 19:32:27 | 000,012,544 | ---- | C] () -- C:\Windows\SysWow64\drivers\limsgt.sys
[2009.12.29 18:12:31 | 001,551,964 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2006.12.08 13:58:14 | 000,069,632 | ---- | C] () -- C:\Windows\SysWow64\FxShared.dll
[2006.12.08 02:52:50 | 000,069,632 | ---- | C] () -- C:\Windows\SysWow64\com.fxpansion.fxshared.dll
[1999.07.07 01:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\D81EDBF9-D167-4011-B77D-211DF920EB80
[1999.07.07 01:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\4C3B2B99-ECAA-4D9D-B9D5-9F7442A71C71
 
========== LOP Check ==========
 
[2010.09.05 11:40:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.minecraft
[2010.12.12 13:46:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.purple
[2009.12.29 18:54:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ambient Design
[2009.12.29 18:55:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\AMPSoft
[2010.01.22 15:15:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Applied Acoustics Systems
[2010.05.12 11:08:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Aurora.org
[2010.10.19 20:59:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Explore
[2010.01.28 15:16:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Scribe
[2009.12.29 18:57:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Blender Foundation
[2010.05.03 13:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bump Technologies, Inc
[2010.02.19 14:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\CasualForge
[2010.02.25 18:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Celemony Software GmbH
[2010.12.09 22:21:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.02.16 19:52:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Clonk Rage
[2010.08.20 21:45:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ColorSchemer
[2010.03.31 14:30:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1
[2010.02.04 21:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\concept design
[2010.07.11 12:09:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Dexpot
[2010.01.07 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\flightgear.org
[2010.01.07 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\fltk.org
[2010.03.15 12:29:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\foobar2000
[2010.05.30 16:38:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\GetRightToGo
[2010.12.04 18:35:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gnupg
[2010.12.04 20:48:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gtk-2.0
[2010.01.17 15:20:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hardcore
[2010.05.25 11:17:15 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ImgBurn
[2010.01.03 17:37:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\inkscape
[2010.01.22 15:41:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Juce VST Host
[2010.05.24 21:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Lindy
[2010.09.20 13:35:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\LucasArts
[2010.07.13 17:07:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MAGIX
[2010.05.16 12:39:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\McLoad
[2010.11.01 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MockFlow
[2010.01.04 22:39:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mp3tag
[2010.06.25 22:41:44 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NCH Swift Sound
[2010.09.23 15:50:10 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Need for Speed World
[2009.12.30 16:40:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Notepad++
[2010.09.27 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenCube Inc
[2010.01.03 16:05:39 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenOffice.org
[2010.01.15 23:33:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Opera
[2010.08.01 15:59:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PACE Anti-Piracy
[2010.01.13 15:54:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PC Suite
[2010.06.09 21:28:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PDF Writer
[2010.02.19 23:17:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PlayFirst
[2009.12.29 18:17:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Publish Providers
[2010.08.02 13:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2010.09.26 15:09:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Samsung
[2010.01.10 21:49:29 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ScummVM
[2010.03.04 19:56:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sierra
[2010.07.29 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sigel
[2010.07.11 21:15:11 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sony
[2010.08.01 15:59:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.01.01 16:17:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Teeworlds
[2010.02.14 11:38:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Thunderbird
[2010.10.28 16:50:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Trillian
[2010.12.04 12:55:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Tropico 3
[2010.10.29 14:24:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TrueCrypt
[2010.01.17 15:29:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TuneUp Software
[2010.07.08 17:05:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.03.21 13:18:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ubisoft
[2010.11.15 18:33:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\uTorrent
[2010.02.18 14:29:24 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ValuSoft
[2010.10.19 21:09:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wacom
[2010.10.19 21:09:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2010.11.10 19:28:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Warsow 0.5
[2009.12.30 19:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wings3D
[2010.01.28 14:11:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTouch
[2010.11.02 13:49:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\XMedia Recode
[2010.05.19 13:52:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Z-Systems
[2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Zylom
[2010.02.10 21:04:44 | 000,000,000 | ---D | M] -- C:\Users\Mit Gästen\AppData\Roaming\TuneUp Software
[2010.02.10 21:02:44 | 000,000,000 | ---D | M] -- C:\Users\Mit Gästen\AppData\Roaming\WTouch
[2010.09.15 12:36:12 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.09.05 11:40:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.minecraft
[2010.12.12 13:46:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.purple
[2010.11.26 23:24:47 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Adobe
[2009.12.29 18:54:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ambient Design
[2009.12.29 18:55:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\AMPSoft
[2010.01.15 23:34:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Apple Computer
[2010.01.22 15:15:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Applied Acoustics Systems
[2010.05.12 11:08:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Aurora.org
[2010.03.25 18:22:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Avira
[2010.10.19 20:59:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Explore
[2010.01.28 15:16:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Scribe
[2009.12.29 18:57:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Blender Foundation
[2010.05.03 13:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bump Technologies, Inc
[2010.02.19 14:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\CasualForge
[2010.02.25 18:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Celemony Software GmbH
[2010.12.09 22:21:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.02.16 19:52:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Clonk Rage
[2010.08.20 21:45:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ColorSchemer
[2010.03.31 14:30:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1
[2010.02.04 21:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\concept design
[2010.07.11 12:09:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Dexpot
[2010.07.11 14:42:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\DivX
[2010.12.04 20:43:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\dvdcss
[2010.01.07 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\flightgear.org
[2010.01.07 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\fltk.org
[2010.03.15 12:29:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\foobar2000
[2010.05.30 16:38:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\GetRightToGo
[2010.12.04 18:35:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gnupg
[2010.03.21 14:30:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Google
[2010.12.04 20:48:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gtk-2.0
[2010.09.14 19:55:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hamachi
[2010.01.17 15:20:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hardcore
[2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Identities
[2010.05.25 11:17:15 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ImgBurn
[2010.01.03 17:37:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\inkscape
[2010.01.02 18:29:30 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\InstallShield
[2010.01.22 15:41:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Juce VST Host
[2010.05.24 21:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Lindy
[2010.09.20 13:35:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\LucasArts
[2010.02.10 14:07:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Macromedia
[2010.07.13 17:07:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MAGIX
[2010.05.16 12:39:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\McLoad
[2009.07.14 19:18:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Media Center Programs
[2010.10.17 18:54:29 | 000,000,000 | --SD | M] -- C:\Users\Christoph\AppData\Roaming\Microsoft
[2010.11.01 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MockFlow
[2010.01.02 18:33:19 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mozilla
[2010.01.04 22:39:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mp3tag
[2010.06.25 22:41:44 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NCH Swift Sound
[2010.09.23 15:50:10 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Need for Speed World
[2010.01.06 22:01:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Nero
[2009.12.30 16:40:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Notepad++
[2010.08.26 21:37:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NVIDIA
[2010.09.27 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenCube Inc
[2010.01.03 16:05:39 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenOffice.org
[2010.01.15 23:33:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Opera
[2010.08.01 15:59:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PACE Anti-Piracy
[2010.01.13 15:54:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PC Suite
[2010.06.09 21:28:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PDF Writer
[2010.02.19 23:17:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PlayFirst
[2009.12.29 18:17:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Publish Providers
[2010.08.02 13:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2010.09.26 15:09:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Samsung
[2010.01.10 21:49:29 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ScummVM
[2010.06.25 16:07:48 | 000,000,000 | RH-D | M] -- C:\Users\Christoph\AppData\Roaming\SecuROM
[2010.03.04 19:56:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sierra
[2010.07.29 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sigel
[2010.12.02 19:21:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Skype
[2010.06.17 17:23:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\skypePM
[2010.07.11 21:15:11 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sony
[2010.08.01 15:59:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.01.01 16:17:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Teeworlds
[2010.02.14 11:38:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Thunderbird
[2010.10.28 16:50:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Trillian
[2010.12.04 12:55:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Tropico 3
[2010.10.29 14:24:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TrueCrypt
[2010.01.17 15:29:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TuneUp Software
[2010.07.08 17:05:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.03.21 13:18:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ubisoft
[2010.11.15 18:33:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\uTorrent
[2010.02.18 14:29:24 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ValuSoft
[2010.12.11 19:09:57 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\vlc
[2010.03.02 19:24:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\VMware
[2010.10.19 21:09:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wacom
[2010.10.19 21:09:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2010.11.10 19:28:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Warsow 0.5
[2010.12.02 21:32:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Winamp
[2009.12.30 19:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wings3D
[2010.02.13 14:35:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WinRAR
[2010.12.12 12:56:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTablet
[2010.01.28 14:11:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTouch
[2010.11.02 13:49:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\XMedia Recode
[2010.05.19 13:52:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Z-Systems
[2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Zylom
 
< %APPDATA%\*.exe /s >
[2010.11.02 12:38:36 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Christoph\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.08.01 14:09:12 | 000,010,134 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
[2010.01.03 15:55:40 | 000,010,134 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\Foren.exe
[2010.01.03 15:55:40 | 000,000,766 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\htmledit.exe
[2010.12.12 13:19:48 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
[2010.01.04 14:12:35 | 000,000,766 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{50CBBEC7-1010-41C5-8718-A1A6FEDD9C3A}\ARPPRODUCTICON.exe
[2010.08.19 22:46:28 | 001,312,120 | ---- | M] (EA Digital Illusions CE AB) -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
[2010.09.26 15:44:24 | 089,280,248 | ---- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\Christoph\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_For_Full_Update_IH2_7.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 08:44:20 | 000,855,040 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2009.12.19 23:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\Users\Christoph\Christoph\Produktionen\Webdesign\In Bearbeitung\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2009.11.27 09:49:23 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.11.27 09:49:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.11.27 09:49:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009.11.27 09:49:23 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 17:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys
[2009.06.04 17:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastor.inf_amd64_neutral_c065a1006c648409\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 02:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtmsft.dll
[2009.07.14 02:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtrans.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:DD4DD9B9

< End of report >


Extras:
Code:
OTL Extras logfile created on: 12.12.2010 13:51:25 - Run 1
OTL by OldTimer - Version 3.2.17.3    Folder = C:\Users\Christoph\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
8,00 Gb Paging File | 6,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,75 Gb Total Space | 240,58 Gb Free Space | 51,65% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 27,28 Gb Free Space | 11,72% Space Free | Partition Type: NTFS
Drive F: | 180,37 Gb Total Space | 136,02 Gb Free Space | 75,41% Space Free | Partition Type: NTFS
 
Computer Name: CHRISTOPH-PC | User Name: Christoph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" File not found
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" File not found
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{50CBBEC7-1010-41C5-8718-A1A6FEDD9C3A}" = GEAR driver installer for AMD64 and Intel EM64T
"{563F041C-DFDB-437B-A1E8-E141E0906076}" = Microsoft IntelliPoint 8.0
"{6BED4DFE-C527-463E-B93A-6F6848B74DD0}" = Native Instruments Battery 3
"{70AC9B8B-5DC4-4E5E-964B-2A695D157FCB}" = Sun VirtualBox
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"BC15EA930074932BB2C4B4493C9FD4EA95087D1A" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.1.0.1159
"CCleaner" = CCleaner
"Lexmark Pro200-S500 Series" = Lexmark Pro200-S500 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"UDK-253020cb-36fa-46d8-b003-ff05a0f0d427" = Unreal Development Kit: 2010-01
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0341796A-9224-48FB-AAE1-4079C7AE375E}" = DDXRenderer
"{03534DA5-2F88-4B8E-A978-849B979E1B8F}" = TuxGuitar
"{03DEAAE3-8668-70F6-8E11-2FE466B63806}" = MockFlow Desktop
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{08581E23-EC5B-4AEC-8DB9-F186D751129F}" = Bamboo Scribe Shared Files
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F4B91C5-4524-02A6-1D9B-5AE52CE2E0F4}" = Bamboo Dock
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste
"{10812DE7-2E57-4740-B226-6B3BE34AF9D7}" = Lexmark Tools for Office
"{15A60757-91A9-8875-17C4-7E5C4A7E17AF}" = Livebrush Mini
"{171E6C1E-B5FC-11DF-B115-005056C00008}" = Google Earth Plug-in
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1AC38EA5-454C-4443-834F-6B34106581E1}" = Sony DVD Architect 4.0
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 22
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{29F05234-DCBB-4FE0-88DC-5160C9250312}" = Adobe Photoshop CS3
"{2B7E4354-0492-460A-BDB1-1F59EE141025}" = AirPlus XtremeG DWL-G122
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{3763A2B4-B07A-4E4D-994D-7D2C6AF0CF9E}" = Safari
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{41785C66-90F2-40CE-8CB5-1C94BFC97280}" = Microsoft Chart Controls for Microsoft .NET Framework 3.5
"{45873324-094C-4516-A84A-134A175A1CD6}" = PDFExport
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4723f199-fa64-4233-8e6e-9fccc95a18ee}" = Python 2.6.5
"{47CC1AED-3A94-47FC-AE9D-902C55B1AE7D}" = Microsoft® Office-Add-In for Moodle
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{548CDAD3-9144-4B04-977C-30CAB4838976}" = Grip points
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57E7F262-3B6A-403E-81C2-E9D2B196D00C}" = DDXSheetSets
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6559654F-2F38-491F-8411-211517C3E635}" = SampleTank FREE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{7BD0D8F8-A13C-48D2-B201-4AD29A48AF34}" = Google SketchUp 7
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{88871882-f889-4732-b8dc-87f31cdcde40}" = Nero 9 Essentials
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISER_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92377672-DF6E-4D7C-AFFC-50B01254C488}" = DDXViewX
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{96965E6C-41DB-4E0A-BC65-D92381D51D2A}" = Sony Vegas 7.0
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A07B2C21-863B-47AB-AE7E-20BB00BD7D33}" = ANNO 1404 - Venedig
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5101403-2C42-40E0-8D9E-5E49E7C3B89E}" = Tycoon City - New York
"{A7385936-7917-4210-9471-ECDF300D1D02}" = DWGdirectX Core
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A837BCE6-BCB1-4A44-8807-A678EAF06933}" = ANNO 1404 Entwickler-Tools
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{B9BD670E-E9BF-494A-9843-F20C13EE8C4C}" = ArtRage 2
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C51496B3-E15E-41D8-B812-9492E4EC86E0}" = DDX DWF Support
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{C9E129BC-27D3-436E-BAAC-4CE81E0962F1}" = Sony Media Manager 2.2
"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help
"{CD7DB485-A1D7-4FA5-B66B-587CFF6CA361}" = DDX Field Evaluator
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E5C7D048-F9B4-4219-B323-8BDB01A2563D}" = Nero DriveSpeed Help
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EC9A0711-9823-4DD2-83C4-039886A3ECF6}" = Melodyne 3.2 Demo
"{EC9F368A-79DC-4AAE-907A-FC02D512034E}" = RippMe
"{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}" = Adobe Setup
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{F6BDD7C5-89ED-4569-9318-469AA9732572}" = Nero BurnRights Help
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote
"{FB8148DD-C575-4B0A-9F6C-0CFC46937930}" = Opera 10.10
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_5f143314a5d434c8511097393d17397" = Adobe Photoshop CS3
"Afterburner" = MSI Afterburner 1.0.0
"ASIO4ALL" = ASIO4ALL
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Bamboo Dock" = Bamboo Dock 3.3
"Bamboo Explore" = Bamboo Explore
"Bamboo Scribe_is1" = Bamboo Scribe
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1" = Livebrush Mini
"DivX Setup.divx.com" = DivX-Setup
"DVD Shrink_is1" = DVD Shrink 3.2
"Edirol HQ Orchestral VSTi v1.03" = Edirol HQ Orchestral VSTi v1.03
"ENTERPRISER" = Microsoft Office Enterprise 2007
"FeedDemon_is1" = FeedDemon
"FL Studio 9" = FL Studio 9
"foobar2000" = foobar2000 v1.0.1
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"GameSpy Arcade" = GameSpy Arcade
"GnuPG" = GNU Privacy Guard
"GPL Ghostscript 8.64" = GPL Ghostscript 8.64
"Grand Theft Auto" = Grand Theft Auto
"Hamachi" = Hamachi 1.0.1.5
"Hardcore" = Hardcore
"iecollection_is1" = Internet Explorer Collection 1.6.0.4
"IETester" = IETester v0.4.4 (remove only)
"IL Download Manager" = IL Download Manager
"ImgBurn" = ImgBurn
"Inkscape" = Inkscape 0.47
"LeechFTP" = LeechFTP
"LMMS 0.4.6" = Linux MultiMedia Studio (LMMS)
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"MockFlow" = MockFlow Desktop
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (3.1.4)" = Mozilla Thunderbird (3.1.4)
"Mp3tag" = Mp3tag v2.45a
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"Native Instruments Absynth 4" = Native Instruments Absynth 4
"Native Instruments Battery 3" = Native Instruments Battery 3
"Native Instruments FM8" = Native Instruments FM8
"Native Instruments Massive" = Native Instruments Massive
"Native Instruments Pro-53" = Native Instruments Pro-53
"Native Instruments Service Center" = Native Instruments Service Center
"Notepad++" = Notepad++
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Pen Tablet Driver" = Bamboo
"Pidgin" = Pidgin
"PoiZone" = PoiZone
"PunkBusterSvc" = PunkBuster Services
"RocketDock_is1" = RocketDock 1.3.5
"Sakura" = Sakura
"Sawer" = Sawer
"Scribus 1.3.3.13" = Scribus 1.3.3.13
"ScummVM_is1" = ScummVM 1.0.0
"Sigel Professional Label Software SE" = Sigel Professional Label Software SE
"Sonik Synth 2 Free" = Sonik Synth 2 Free
"Steam App 23490" = Tropico 3 - Steam Special Edition
"Steam App 32360" = The Secret of Monkey Island: Special Edition
"Steam App 32460" = Monkey Island 2: Special Edition
"Steam App 37600" = Windosill
"Steam App 410" = Portal: The First Slice
"Steam App 57600" = Tropico 3: Absolute Power
"Steam App 630" = Alien Swarm
"Steam App 640" = Alien Swarm - SDK
"Syncrosoft License Control" = Syncrosoft Lizenz Kontrolle
"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.1
"Toxic Biohazard" = Toxic Biohazard
"TrueCrypt" = TrueCrypt
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.5
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
"WavePad" = WavePad Sound Editor
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.10
"Wings 3D 1.0.1" = Wings 3D 1.0.1
"XMedia Recode" = XMedia Recode 2.2.7.7
"Xvid_is1" = Xvid 1.2.2 final uninstall
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dexpot" = Dexpot
"Google Chrome" = Google Chrome
"NCsoft-Exteel" = Exteel (US)
"Winamp Detect" = Winamp Anwendungserkennung
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 11.12.2010 10:40:45 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9001
 
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 10015
 
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10015
 
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11014
 
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11014
 
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 12012
 
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 12012
 
[ Media Center Events ]
Error - 03.02.2010 06:07:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 11:07:17 - Fehler beim Herstellen der Internetverbindung.  11:07:17
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 03.02.2010 06:07:26 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 11:07:22 - Fehler beim Herstellen der Internetverbindung.  11:07:22
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 01.10.2010 07:35:09 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 13:35:08 - Fehler beim Herstellen der Internetverbindung.  13:35:09
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 01.10.2010 07:35:31 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 13:35:15 - Fehler beim Herstellen der Internetverbindung.  13:35:15
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 01.10.2010 08:35:37 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 14:35:37 - Fehler beim Herstellen der Internetverbindung.  14:35:37
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 01.10.2010 08:35:43 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 14:35:42 - Fehler beim Herstellen der Internetverbindung.  14:35:42
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 01.10.2010 09:43:58 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 15:43:57 - Fehler beim Herstellen der Internetverbindung.  15:43:57
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 01.10.2010 09:44:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 15:44:03 - Fehler beim Herstellen der Internetverbindung.  15:44:03
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 04.10.2010 22:31:45 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 04:31:45 - Fehler beim Herstellen der Internetverbindung.  04:31:45
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 04.10.2010 22:32:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 04:32:14 - Fehler beim Herstellen der Internetverbindung.  04:32:14
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ OSession Events ]
Error - 25.05.2010 06:14:44 | Computer Name = Christoph-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 55
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 11.12.2010 07:21:00 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description =
 
Error - 11.12.2010 07:28:57 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description =
 
Error - 11.12.2010 07:52:58 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description =
 
Error - 12.12.2010 07:55:43 | Computer Name = Christoph-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\athsgt.sys
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 12.12.2010 07:55:43 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "athsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1275
 
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\limsgt.sys
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "limsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1275
 
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 lxebCATSCustConnectService erreicht.
 
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lxebCATSCustConnectService" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1053
 
Error - 12.12.2010 07:56:47 | Computer Name = Christoph-PC | Source = DCOM | ID = 10016
Description =
 
 
< End of report >

markusg 12.12.2010 14:44
• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe ()
PRC - C:\Users\Christoph\AppData\Local\Temp\Rnv.exe ()
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe ()
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe ()
[2010.12.09 22:21:34 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten.


öffne mein computer, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html

craep 12.12.2010 15:02
Code:
All processes killed
========== OTL ==========
No active process named Rnx.exe was found!
No active process named Rnv.exe was found!
No active process named Rnw.exe was found!
Registry value HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Run\\JP595IR86O deleted successfully.
C:\Users\Christoph\AppData\Local\Temp\Rnv.exe moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\HelpCfg\de_DE folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\HelpCfg folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#ApplicationUpdater folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 folder moved successfully.
C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job moved successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job moved successfully.
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job moved successfully.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Christoph
->Flash cache emptied: 60817 bytes
 
User: Default
->Flash cache emptied: 56502 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Mit Gästen
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Christoph
->Temp folder emptied: 178073082 bytes
->Temporary Internet Files folder emptied: 86746521 bytes
->Java cache emptied: 38798320 bytes
->FireFox cache emptied: 105115126 bytes
->Google Chrome cache emptied: 12916663 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 1787727 bytes
->Flash cache emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Mit Gästen
->Temp folder emptied: 32799 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 155648 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 36168 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 701976 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 1844458 bytes
 
Total Files Cleaned = 407,00 mb
 
 
OTL by OldTimer - Version 3.2.17.3 log created on 12122010_145442

Files\Folders moved on Reboot...
C:\Users\Christoph\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Windows\temp\TMP00000554C0B6FC6017459710 moved successfully.

Registry entries deleted on Reboot...

Die Moved Files Datei ist hochgeladen als movedfiles.rar_1 oder so ähnlich.

markusg 12.12.2010 15:06
wunderbar.
pc neustarten.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

craep 12.12.2010 15:31
Code:
ComboFix 10-12-11.06 - Christoph 12.12.2010  15:21:23.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.4087.2776 [GMT 1:00]
ausgeführt von:: c:\users\Christoph\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Install.exe
c:\program files\Blender
c:\program files\Blender\.blender\.bfont.ttf
c:\program files\Blender\.blender\.Blanguages
c:\program files\Blender\.blender\Bpymenus
c:\program files\Blender\.blender\locale\ar\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\bg\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ca\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\cs\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\de\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\el\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\es\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\fi\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\fr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\hr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\hr_HR\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\it\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ja\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ko\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\nl\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\pl\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\pt_BR\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ro\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ru\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sr@Latn\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sv\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\uk\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\zh_CN\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\scripts\3ds_export.py
c:\program files\Blender\.blender\scripts\3ds_import.py
c:\program files\Blender\.blender\scripts\ac3d_export.py
c:\program files\Blender\.blender\scripts\ac3d_import.py
c:\program files\Blender\.blender\scripts\add_mesh_empty.py
c:\program files\Blender\.blender\scripts\add_mesh_torus.py
c:\program files\Blender\.blender\scripts\animation_bake_constraints.py
c:\program files\Blender\.blender\scripts\animation_clean.py
c:\program files\Blender\.blender\scripts\animation_trajectory.py
c:\program files\Blender\.blender\scripts\armature_symmetry.py
c:\program files\Blender\.blender\scripts\Axiscopy.py
c:\program files\Blender\.blender\scripts\bevel_center.py
c:\program files\Blender\.blender\scripts\blenderLipSynchro.py
c:\program files\Blender\.blender\scripts\bpydata\config\readme.txt
c:\program files\Blender\.blender\scripts\bpydata\KUlang.txt
c:\program files\Blender\.blender\scripts\bpydata\readme.txt
c:\program files\Blender\.blender\scripts\bpymodules\blend2renderinfo.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyAddMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyArmature.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyBlender.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyCurve.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyImage.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMathutils.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMesh_redux.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMessages.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyNMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyObject.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyRegistry.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyRender.py
c:\program files\Blender\.blender\scripts\bpymodules\BPySys.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyTextPlugin.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyWindow.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\__init__.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\collada.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\cstartup.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\cutils.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\helperObjects.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\logo.png
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\translator.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\xmlUtils.py
c:\program files\Blender\.blender\scripts\bpymodules\defaultdoodads.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfColorMap.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfLibrary.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfReader.py
c:\program files\Blender\.blender\scripts\bpymodules\mesh_gradient.py
c:\program files\Blender\.blender\scripts\bpymodules\meshtools.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_ai2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_eps2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_gimp2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_svg2obj.py
c:\program files\Blender\.blender\scripts\bvh_import.py
c:\program files\Blender\.blender\scripts\c3d_import.py
c:\program files\Blender\.blender\scripts\camera_changer.py
c:\program files\Blender\.blender\scripts\collada_export.py
c:\program files\Blender\.blender\scripts\collada_import.py
c:\program files\Blender\.blender\scripts\colladaExport14.py
c:\program files\Blender\.blender\scripts\colladaImport14.py
c:\program files\Blender\.blender\scripts\config.py
c:\program files\Blender\.blender\scripts\console.py
c:\program files\Blender\.blender\scripts\DirectX8Exporter.py
c:\program files\Blender\.blender\scripts\DirectX8Importer.py
c:\program files\Blender\.blender\scripts\discombobulator.py
c:\program files\Blender\.blender\scripts\envelope_symmetry.py
c:\program files\Blender\.blender\scripts\export-iv-0.1.py
c:\program files\Blender\.blender\scripts\export_dxf.py
c:\program files\Blender\.blender\scripts\export_fbx.py
c:\program files\Blender\.blender\scripts\export_lightwave_motion.py
c:\program files\Blender\.blender\scripts\export_m3g.py
c:\program files\Blender\.blender\scripts\export_map.py
c:\program files\Blender\.blender\scripts\export_mdd.py
c:\program files\Blender\.blender\scripts\export_obj.py
c:\program files\Blender\.blender\scripts\faceselect_same_weights.py
c:\program files\Blender\.blender\scripts\flt_defaultp.py
c:\program files\Blender\.blender\scripts\flt_dofedit.py
c:\program files\Blender\.blender\scripts\flt_export.py
c:\program files\Blender\.blender\scripts\flt_filewalker.py
c:\program files\Blender\.blender\scripts\flt_import.py
c:\program files\Blender\.blender\scripts\flt_lodedit.py
c:\program files\Blender\.blender\scripts\flt_palettemanager.py
c:\program files\Blender\.blender\scripts\flt_properties.py
c:\program files\Blender\.blender\scripts\flt_toolbar.py
c:\program files\Blender\.blender\scripts\help_bpy_api.py
c:\program files\Blender\.blender\scripts\help_browser.py
c:\program files\Blender\.blender\scripts\help_getting_started.py
c:\program files\Blender\.blender\scripts\help_manual.py
c:\program files\Blender\.blender\scripts\help_release_notes.py
c:\program files\Blender\.blender\scripts\help_tutorials.py
c:\program files\Blender\.blender\scripts\help_web_blender.py
c:\program files\Blender\.blender\scripts\help_web_devcomm.py
c:\program files\Blender\.blender\scripts\help_web_eshop.py
c:\program files\Blender\.blender\scripts\help_web_usercomm.py
c:\program files\Blender\.blender\scripts\hotkeys.py
c:\program files\Blender\.blender\scripts\IDPropBrowser.py
c:\program files\Blender\.blender\scripts\image_2d_cutout.py
c:\program files\Blender\.blender\scripts\image_auto_layout.py
c:\program files\Blender\.blender\scripts\image_billboard.py
c:\program files\Blender\.blender\scripts\image_edit.py
c:\program files\Blender\.blender\scripts\import_dxf.py
c:\program files\Blender\.blender\scripts\import_edl.py
c:\program files\Blender\.blender\scripts\import_lightwave_motion.py
c:\program files\Blender\.blender\scripts\import_mdd.py
c:\program files\Blender\.blender\scripts\import_obj.py
c:\program files\Blender\.blender\scripts\import_web3d.py
c:\program files\Blender\.blender\scripts\lightwave_export.py
c:\program files\Blender\.blender\scripts\lightwave_import.py
c:\program files\Blender\.blender\scripts\md2_export.py
c:\program files\Blender\.blender\scripts\md2_import.py
c:\program files\Blender\.blender\scripts\mesh_boneweight_copy.py
c:\program files\Blender\.blender\scripts\mesh_cleanup.py
c:\program files\Blender\.blender\scripts\mesh_edges2curves.py
c:\program files\Blender\.blender\scripts\mesh_mirror_tool.py
c:\program files\Blender\.blender\scripts\mesh_poly_reduce.py
c:\program files\Blender\.blender\scripts\mesh_poly_reduce_grid.py
c:\program files\Blender\.blender\scripts\mesh_skin.py
c:\program files\Blender\.blender\scripts\mesh_solidify.py
c:\program files\Blender\.blender\scripts\mesh_unfolder.py
c:\program files\Blender\.blender\scripts\mesh_wire.py
c:\program files\Blender\.blender\scripts\ms3d_import.py
c:\program files\Blender\.blender\scripts\ms3d_import_ascii.py
c:\program files\Blender\.blender\scripts\obdatacopier.py
c:\program files\Blender\.blender\scripts\object_active_to_other.py
c:\program files\Blender\.blender\scripts\object_apply_def.py
c:\program files\Blender\.blender\scripts\object_batch_name_edit.py
c:\program files\Blender\.blender\scripts\object_cookie_cutter.py
c:\program files\Blender\.blender\scripts\object_drop.py
c:\program files\Blender\.blender\scripts\object_find.py
c:\program files\Blender\.blender\scripts\object_random_loc_sz_rot.py
c:\program files\Blender\.blender\scripts\object_sel2dupgroup.py
c:\program files\Blender\.blender\scripts\object_timeofs_follow_act.py
c:\program files\Blender\.blender\scripts\off_export.py
c:\program files\Blender\.blender\scripts\off_import.py
c:\program files\Blender\.blender\scripts\paths_import.py
c:\program files\Blender\.blender\scripts\ply_export.py
c:\program files\Blender\.blender\scripts\ply_import.py
c:\program files\Blender\.blender\scripts\raw_export.py
c:\program files\Blender\.blender\scripts\raw_import.py
c:\program files\Blender\.blender\scripts\renameobjectbyblock.py
c:\program files\Blender\.blender\scripts\render_save_layers.py
c:\program files\Blender\.blender\scripts\rvk1_torvk2.py
c:\program files\Blender\.blender\scripts\save_theme.py
c:\program files\Blender\.blender\scripts\scripttemplate_background_job.py
c:\program files\Blender\.blender\scripts\scripttemplate_camera_object.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic_basic.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic_module.py
c:\program files\Blender\.blender\scripts\scripttemplate_ipo_gen.py
c:\program files\Blender\.blender\scripts\scripttemplate_mesh_edit.py
c:\program files\Blender\.blender\scripts\scripttemplate_metaball_create.py
c:\program files\Blender\.blender\scripts\scripttemplate_object_edit.py
c:\program files\Blender\.blender\scripts\scripttemplate_pyconstraint.py
c:\program files\Blender\.blender\scripts\scripttemplate_text_plugin.py
c:\program files\Blender\.blender\scripts\slp_import.py
c:\program files\Blender\.blender\scripts\sysinfo.py
c:\program files\Blender\.blender\scripts\textplugin_convert_ge.py
c:\program files\Blender\.blender\scripts\textplugin_functiondocs.py
c:\program files\Blender\.blender\scripts\textplugin_imports.py
c:\program files\Blender\.blender\scripts\textplugin_membersuggest.py
c:\program files\Blender\.blender\scripts\textplugin_outliner.py
c:\program files\Blender\.blender\scripts\textplugin_suggest.py
c:\program files\Blender\.blender\scripts\textplugin_templates.py
c:\program files\Blender\.blender\scripts\unweld.py
c:\program files\Blender\.blender\scripts\uv_export.py
c:\program files\Blender\.blender\scripts\uv_seams_from_islands.py
c:\program files\Blender\.blender\scripts\uvcalc_follow_active_coords.py
c:\program files\Blender\.blender\scripts\uvcalc_lightmap.py
c:\program files\Blender\.blender\scripts\uvcalc_quad_clickproj.py
c:\program files\Blender\.blender\scripts\uvcalc_smart_project.py
c:\program files\Blender\.blender\scripts\uvcopy.py
c:\program files\Blender\.blender\scripts\vertexpaint_from_material.py
c:\program files\Blender\.blender\scripts\vertexpaint_gradient.py
c:\program files\Blender\.blender\scripts\vertexpaint_selfshadow_ao.py
c:\program files\Blender\.blender\scripts\vrml97_export.py
c:\program files\Blender\.blender\scripts\weightpaint_average.py
c:\program files\Blender\.blender\scripts\weightpaint_clean.py
c:\program files\Blender\.blender\scripts\weightpaint_copy.py
c:\program files\Blender\.blender\scripts\weightpaint_envelope_assign.py
c:\program files\Blender\.blender\scripts\weightpaint_gradient.py
c:\program files\Blender\.blender\scripts\weightpaint_grow_shrink.py
c:\program files\Blender\.blender\scripts\weightpaint_invert.py
c:\program files\Blender\.blender\scripts\weightpaint_normalize.py
c:\program files\Blender\.blender\scripts\widgetwizard.py
c:\program files\Blender\.blender\scripts\wizard_bolt_factory.py
c:\program files\Blender\.blender\scripts\wizard_curve2tree.py
c:\program files\Blender\.blender\scripts\wizard_landscape_ant.py
c:\program files\Blender\.blender\scripts\x3d_export.py
c:\program files\Blender\.blender\scripts\xsi_export.py
c:\program files\Blender\blender-2.49b-win64-python26.zip
c:\program files\Blender\blender.exe
c:\program files\Blender\blender.exe.manifest
c:\program files\Blender\blender.html
c:\program files\Blender\blenderplayer.exe
c:\program files\Blender\BlenderQuickStart.pdf
c:\program files\Blender\copyright.txt
c:\program files\Blender\GPL-license.txt
c:\program files\Blender\libtiff.dll
c:\program files\Blender\makesdna.exe
c:\program files\Blender\makesdna.idb
c:\program files\Blender\plugins\bmake
c:\program files\Blender\plugins\Makefile
c:\program files\Blender\plugins\sequence\blur.c
c:\program files\Blender\plugins\sequence\color-correction-hsv.c
c:\program files\Blender\plugins\sequence\color-correction-yuv.c
c:\program files\Blender\plugins\sequence\dnr.c
c:\program files\Blender\plugins\sequence\gamma.c
c:\program files\Blender\plugins\sequence\Makefile
c:\program files\Blender\plugins\sequence\scatter.c
c:\program files\Blender\plugins\texture\clouds2.c
c:\program files\Blender\plugins\texture\Makefile
c:\program files\Blender\plugins\texture\tiles.c
c:\program files\Blender\pthreadVC2.dll
c:\program files\Blender\Python-license.txt
c:\program files\Blender\python26.dll
c:\program files\Blender\release_249.txt
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\SysWow64\msvcsv60.dll
c:\windows\SysWow64\NSREG.DLL
c:\windows\XSxS

----- BITS: Eventuell infizierte Webseiten -----

hxxp://officelabs.vo.msecnd.net
.
(((((((((((((((((((((((  Dateien erstellt von 2010-11-12 bis 2010-12-12  ))))))))))))))))))))))))))))))
.

2010-12-12 14:27 . 2010-12-12 14:27        --------        d-----w-        c:\users\Mit Gästen\AppData\Local\temp
2010-12-12 14:27 . 2010-12-12 14:27        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-12-12 13:54 . 2010-12-12 14:00        --------        d-----w-        C:\_OTL
2010-12-12 12:19 . 2010-12-12 12:19        388096        ----a-r-        c:\users\Christoph\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-10 12:06 . 2010-11-10 05:35        8199504        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{9F3DCEEC-0D43-4464-899A-74354B19A15A}\mpengine.dll
2010-11-27 14:35 . 2010-12-04 11:55        --------        d-----w-        c:\users\Christoph\AppData\Roaming\Tropico 3
2010-11-26 22:31 . 2010-11-26 22:31        --------        d-----w-        c:\program files (x86)\MockFlow
2010-11-26 21:14 . 2010-11-26 21:14        --------        d-----w-        c:\programdata\WorldWindData
2010-11-24 13:06 . 2010-10-19 08:47        7680        ----a-w-        c:\program files\Internet Explorer\iecompat.dll
2010-11-24 13:06 . 2010-10-19 08:10        7680        ----a-w-        c:\program files (x86)\Internet Explorer\iecompat.dll
2010-11-16 17:45 . 2009-04-28 02:56        24064        ----a-w-        c:\windows\SysWow64\lxebsmr.dll
2010-11-16 17:45 . 2009-04-28 02:56        24064        ----a-w-        c:\windows\system32\lxebsmr.dll
2010-11-16 17:45 . 2010-04-13 14:41        836608        ----a-w-        c:\windows\system32\lxebcoin.dll
2010-11-16 17:45 . 2009-11-09 03:36        245248        ----a-w-        c:\windows\system32\lxebinsb.dll
2010-11-16 17:45 . 2009-11-09 03:35        378368        ----a-w-        c:\windows\system32\lxebcu.dll
2010-11-16 17:45 . 2009-11-09 03:35        450048        ----a-w-        c:\windows\system32\lxebins.dll
2010-11-16 17:45 . 2009-11-09 03:06        65536        ----a-w-        c:\windows\system32\lxebgcfg.dll
2010-11-16 17:45 . 2009-10-21 05:06        399360        ----a-w-        c:\windows\system32\lxebcui.dll
2010-11-16 17:45 . 2009-06-07 19:21        148480        ----a-w-        c:\windows\system32\lxebcuir.dll
2010-11-15 13:39 . 2010-11-15 13:39        17459253        ----a-w-        c:\programdata\SPLF9BA.tmp
2010-11-15 13:39 . 2010-11-15 13:39        17459253        ----a-w-        c:\programdata\SPL673C.tmp
2010-11-15 13:34 . 2010-11-15 13:34        17459253        ----a-w-        c:\programdata\SPL5580.tmp
2010-11-15 13:34 . 2010-11-15 13:34        17459253        ----a-w-        c:\programdata\SPLFAA4.tmp
2010-11-15 12:59 . 2010-11-15 12:59        17459253        ----a-w-        c:\programdata\SPLDFE2.tmp
2010-11-14 19:19 . 2007-02-23 18:09        905728        ----a-w-        c:\windows\system32\synsoacc.dll
2010-11-14 19:19 . 2006-11-16 15:58        31248        ----a-w-        c:\windows\system32\drivers\synUSB64.sys
2010-11-14 19:19 . 2006-01-29 11:48        45056        ----a-w-        c:\windows\SysWow64\Synsopos.exe
2010-11-14 19:19 . 2006-01-29 11:48        401462        ----a-w-        c:\windows\SysWow64\temp.000
2010-11-14 19:19 . 2007-02-23 12:57        757760        ----a-w-        c:\windows\SysWow64\SYNSOACC.dll
2010-11-14 19:19 . 2006-01-29 11:48        147456        ----a-w-        c:\windows\SysWow64\SynsoLChk.dll
2010-11-14 19:19 . 2010-11-14 19:19        --------        d-----w-        c:\program files (x86)\Syncrosoft
2010-11-14 19:16 . 2010-11-14 19:16        --------        d-----w-        C:\Install
2010-11-14 12:14 . 2010-11-14 12:14        17459253        ----a-w-        c:\programdata\SPLA213.tmp
2010-11-13 12:40 . 2010-11-13 12:40        17459253        ----a-w-        c:\programdata\SPLD58.tmp

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-22 13:17 . 2010-01-02 17:43        83120        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2010-11-16 20:07 . 2010-01-08 19:39        215016        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2010-11-16 20:07 . 2010-01-06 12:46        215016        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2010-11-12 12:43 . 2010-11-12 12:43        17659656        ----a-w-        c:\programdata\SPL916.tmp
2010-11-12 12:42 . 2010-11-12 12:42        17659656        ----a-w-        c:\programdata\SPLF873.tmp
2010-11-12 12:40 . 2010-11-12 12:40        17659656        ----a-w-        c:\programdata\SPLC323.tmp
2010-11-04 16:20 . 2010-01-04 12:21        9624        ----a-w-        c:\users\Christoph\AppData\Roaming\Microsoft\IdentityCRL\production\WLIDClientConfig.dll
2010-10-19 09:41 . 2010-01-02 19:15        270720        ------w-        c:\windows\system32\MpSigStub.exe
2010-10-08 15:09 . 2006-09-28 19:53        499712        ----a-w-        c:\windows\SysWow64\msvcp71.dll
2010-10-08 15:09 . 2006-09-28 19:53        348160        ----a-w-        c:\windows\SysWow64\msvcr71.dll
2010-10-05 03:32 . 2010-01-03 09:43        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-10-05 03:32 . 2010-07-24 11:59        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2010-10-05 03:32 . 2010-01-13 13:01        1113408        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-10-01 14:55 . 2010-02-04 08:16        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-10-01 14:44 . 2010-10-01 14:44        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2010-10-01 14:44 . 2010-01-03 09:42        1113408        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-09-26 14:45 . 2010-01-13 14:23        24064        ----a-w-        c:\windows\SysWow64\FsExService64.Exe
2010-09-26 14:45 . 2010-01-13 14:23        16392        ----a-w-        c:\windows\SysWow64\drivers\TFsExDisk.Sys
2010-09-26 14:44 . 2007-10-25 16:26        5632        ----a-w-        c:\windows\SysWow64\drivers\StarOpen.sys
2010-09-15 03:50 . 2010-08-23 11:05        472808        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2010-09-14 17:50 . 2010-09-14 17:50        21832        ----a-w-        c:\windows\system32\drivers\hamachi.sys
2010-06-22 16:36 . 2010-06-24 14:58        1508283        ----a-w-        c:\program files (x86)\Euthymia Electronic Organ V2.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeedDemon"="c:\program files (x86)\FeedDemon\FeedDemon.exe" [2010-12-08 7501824]
"Pidgin"="c:\program files (x86)\Pidgin\pidgin.exe" [2010-11-01 48618]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2010-07-28 609424]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe"
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
"BambooCore"=c:\program files (x86)\Bamboo Dock\BambooCore.exe
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"SwitchBoard"=c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

R2 athsgt;athsgt;c:\windows\system32\DRIVERS\athsgt.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-19 136176]
R2 limsgt;limsgt;c:\windows\system32\DRIVERS\limsgt.sys [x]
R2 lxebCATSCustConnectService;lxebCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [2010-04-14 45736]
R3 ahcix64s;ahcix64s;c:\windows\system32\DRIVERS\ahcix64s.sys [2008-09-10 224272]
R3 amdide64;amdide64;c:\windows\system32\DRIVERS\amdide64.sys [2007-10-12 10632]
R3 ISASerial;PCIe-ISA Communication Port;c:\windows\system32\DRIVERS\ISASerial.sys [2008-02-20 72192]
R3 NmPar;MosChip PCI Parallel Port;c:\windows\system32\DRIVERS\NmPar.sys [x]
R3 nmserial;MosChip PCI Serial Port;c:\windows\system32\DRIVERS\nmserial.sys [x]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2009-09-25 73728]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2009-09-25 178688]
R3 nvamacpi;nvamacpi;c:\windows\system32\DRIVERS\NVAMACPI.sys [2009-07-16 28192]
R3 PciIsaSerial;PCI-ISA Communication Port;c:\windows\system32\DRIVERS\PciIsaSerial.sys [2008-05-22 72192]
R3 PciPPorts;PCI ECP Parallel Port;c:\windows\system32\DRIVERS\PciPPorts.sys [2008-05-22 95744]
R3 PciSPorts;High-Speed PCI Serial Port;c:\windows\system32\DRIVERS\PciSPorts.sys [2008-05-22 126464]
R3 PPorts;PCIe ECP Parallel Port;c:\windows\system32\DRIVERS\PPorts.sys [2008-02-20 95744]
R3 SPorts;High-Speed PCIe Serial Port;c:\windows\system32\DRIVERS\SPorts.sys [2008-02-20 124416]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 SynasUSB;SynasUSB;c:\windows\system32\drivers\SynUSB64.sys [2006-11-16 31248]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2009-01-30 18216]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2010-02-12 193232]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2010-02-12 53264]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]
S2 lxeb_device;lxeb_device;c:\windows\system32\lxebcoms.exe [2010-04-14 1052328]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-07-15 5414184]
S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-07-15 127272]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2010-07-21 45456]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-06-23 344680]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-02-12 145360]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2010-02-12 165200]

.
Inhalt des "geplante Tasks" Ordners

2010-12-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-17 09:36]

2010-12-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-17 09:36]

2010-12-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000Core.job
- c:\users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-15 22:31]

2010-12-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000UA.job
- c:\users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-15 22:31]
.

--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-17 9608224]
"lxebmon.exe"="c:\program files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe" [2010-05-05 770728]
"EzPrint"="c:\program files (x86)\Lexmark Pro200-S500 Series\ezprint.exe" [2009-04-28 139944]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to &Evernote - c:\program files (x86)\Evernote\Evernote3.5\enbar.dll/2000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.de/search?q=
FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu
FF - prefs.js: browser.startup.homepage - hxxp://pinterest.com/|http://www.trojaner-board.de/93690-i...6da82a681c0a0e
FF - prefs.js: keyword.URL - hxxp://www.google.de/search?q=
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}\platform\WINNT_x86-msvc\components\enbar.dll
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam\components\dwmxpcom.dll
FF - plugin: c:\program files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files (x86)\Mozilla Firefox\plugins\npContribute.dll
FF - plugin: c:\program files (x86)\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: c:\program files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: c:\program files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\users\Christoph\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Battlefield Heroes Updater: battlefieldheroespatcher@ea.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com
FF - Ext: Fast Dial: fastdial@telega.phpnet.us - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\fastdial@telega.phpnet.us
FF - Ext: Firebug: firebug@software.joehewitt.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firebug@software.joehewitt.com
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
FF - Ext: Flagfox: {1018e4d6-728f-4b20-ad56-37578a4de76b} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
FF - Ext: Web Developer: {c45c406e-ab73-11d8-be73-000a95be3b12} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Strata40: Strata40@SpewBoy.au - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au
FF - Ext: StrataBuddy: StrataBuddy@ReduxTeam - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam
FF - Ext: App Tabs: apptabs@frankyan.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\apptabs@frankyan.com
FF - Ext: Tab Progress Bar: tabprogressbar@studio17.wordpress.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\tabprogressbar@studio17.wordpress.com
FF - Ext: BetterPrivacy: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
FF - Ext: Chromifox Basic: chromifox@altmusictv.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\chromifox@altmusictv.com
FF - Ext: SkipScreen: SkipScreen@SkipScreen - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\SkipScreen@SkipScreen
FF - Ext: Yet Another Window Resizer: yawr@sdx.hu - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\yawr@sdx.hu
FF - Ext: Evernote Web Clipper: {E0B8C461-F8FB-49b4-8373-FE32E9252800} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
FF - Ext: Pastebin: pastebin.com@gmail.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\pastebin.com@gmail.com
FF - Ext: ColorZilla: {6AC85730-7D0F-4de0-B3FA-21142DD85326} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
FF - Ext: FireGestures: firegestures@xuldev.org - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firegestures@xuldev.org
FF - Ext: HTTPS-Everywhere: https-everywhere@eff.org - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\https-everywhere@eff.org

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-ICQ - c:\program files (x86)\ICQ6.5\ICQ.exe
Toolbar-Locked - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_heroes.exe


.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{63B72BBE-76EE-60B7-A042-F9F60C7F4C38}*]
"haehchfmfjapdmee"=hex:6a,61,64,6b,66,68,64,70,65,65,6e,6e,67,61,6a,66,6f,6a,
  6a,6d,00,2e
"iakkmpddddbcopflgc"=hex:6a,61,64,6b,65,68,63,61,64,61,64,68,64,6f,65,68,65,69,
  6e,61,00,f5

[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\SecuROM\License information*]
"datasecu"=hex:e8,fc,94,29,84,d0,db,10,48,2d,c9,cd,42,9a,33,b3,25,7d,4e,80,de,
  eb,83,ce,75,8f,93,d2,3a,f8,32,d5,3f,75,14,84,94,89,d8,6d,5e,27,ea,29,2f,58,\
"rkeysecu"=hex:51,0a,e3,c2,95,b8,a6,4a,ca,f7,96,b2,22,7b,a3,01

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
@Denied: (A) (Everyone)
"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane]
@Denied: (A) (Everyone)

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
"Key"="ActionsPane"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-12-12  15:29:10
ComboFix-quarantined-files.txt  2010-12-12 14:29

Vor Suchlauf: 14 Verzeichnis(se), 258.599.911.424 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 258.472.767.488 Bytes frei

- - End Of File - - 4DA2C0CF2AA70E45944D44F212C2354A
Ich versteh zwar nicht ganz, wieso es mir Blender gelöscht hat, aber dass ist nicht weiter schlimm...

markusg 12.12.2010 15:39
download malwarebytes:
Malwarebytes
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.

craep 12.12.2010 15:41
Kann es sein, dass die Malware schon weg ist? Alle Anzeichen von vorhin sind verschwunden...
ODer soll ich den Scan trotzdem machen?

markusg 12.12.2010 15:53
den scan trotzdem machen, sieht aber schon gut aus.

craep 12.12.2010 17:08
Som, hat ganz schön lange gedauert. Wahrscheinlich bin ich jetzt sauber!

Code:
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Datenbank Version: 5299

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12.12.2010 17:01:54
mbam-log-2010-12-12 (17-01-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 626947
Laufzeit: 1 Stunde(n), 0 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\JP595IR86O (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\program files (x86)\euthymia electronic organ v2.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\_OTL\movedfiles\12122010_145442\C_Users\christoph\AppData\Local\Temp\Rnv.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.

markusg 12.12.2010 17:09
lade den ccleaner slim:
Piriform - Builds
falls der ccleaner bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

craep 12.12.2010 17:40
Code:
7-Zip 4.65        notwendig                       
ABBYY FineReader 6.0 Sprint        unbekannt                       
Adobe AIR        notwendig                       
Adobe Community Help        notwendig                       
Adobe Flash Player 10 ActiveX        notwendig                       
Adobe Flash Player 10 Plugin        notwendig                       
Adobe Media Player        notwendig                       
Adobe Photoshop CS3        notwendig                       
Adobe Reader 9.4.1 - Deutsch        notwendig                       
Adobe Shockwave Player 11.5        notwendig                       
AirPlus XtremeG DWL-G122        notwendig                       
Alien Swarm        notwendig                       
Alien Swarm - SDK        notwendig                       
ANNO 1404        notwendig                       
ANNO 1404 - Venedig        notwendig                       
ANNO 1404 Entwickler-Tools        notwendig                       
Apple Application Support        notwendig                       
Apple Software Update        notwendig                       
ArtRage 2        notwendig                       
ASIO4ALL        notwendig                       
Assassin's Creed        notwendig                       
Assassin's Creed II        notwendig                       
Audacity 1.2.6        notwendig                       
Avira AntiVir Personal - Free Antivirus        notwendig                       
Bamboo        notwendig                       
Bamboo Dock 3.3        notwendig                       
Bamboo Explore        notwendig                       
Bamboo Scribe        notwendig                       
Bamboo Scribe Shared Files        notwendig                       
Battlefield Heroes        notwendig                       
Bonjour        unnötig                       
Bullzip PDF Printer 7.1.0.1159        notwendig                       
CCleaner        notwendig                       
Dexpot        notwendig                       
DivX-Setup        unnötig                       
DVD Shrink 3.2        notwendig                       
Edirol HQ Orchestral VSTi v1.03        notwendig                       
Empire Earth II        notwendig                       
Evernote        notwendig                       
Exteel (US)        unnötig                       
FeedDemon        notwendig                       
FL Studio 9        notwendig                       
foobar2000 v1.0.1        unnötig                       
Free M4a to MP3 Converter 6.1        unnötig                       
GameSpy Arcade        notwendig                       
GEAR driver installer for AMD64 and Intel EM64T        unnötig                       
GIMP 2.6.10        notwendig                       
GNU Privacy Guard        unbekannt                       
Google Chrome        notwendig                       
Google Earth Plug-in        notwendig                       
Google SketchUp 7        notwendig                       
GPL Ghostscript 8.64        unbekannt                       
Grand Theft Auto        unnötig                       
GTA2        unnötig                       
Hamachi 1.0.1.5        notwendig                       
Hardcore        notwendig                       
HiJackThis        notwendig                       
IETester v0.4.4 (remove only)        notwendig                       
IL Download Manager        notwendig                       
ImgBurn        notwendig                       
Inkscape 0.47        notwendig                       
Internet Explorer Collection 1.6.0.4        notwendig                       
Java(TM) 6 Update 22        notwendig                       
LeechFTP        notwendig                       
Lexmark        notwendig                       
Lexmark Pro200-S500 Series        notwendig                       
Lexmark Symbolleiste        notwendig                       
Lexmark Tools for Office        notwendig                       
Linux MultiMedia Studio (LMMS)        notwendig                       
Livebrush Mini        notwendig                       
Malwarebytes' Anti-Malware        notwendig                       
Microsoft .NET Framework 4 Client Profile        notwendig                       
Microsoft .NET Framework 4 Client Profile DEU Language Pack        notwendig                       
Microsoft Chart Controls for Microsoft .NET Framework 3.5        notwendig                       
Microsoft IntelliPoint 8.0        notwendig                       
Microsoft Office Enterprise 2007        notwendig                       
Microsoft Silverlight        notwendig                       
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)        notwendig                       
Microsoft Text-to-Speech Engine 4.0 (English)        notwendig                       
Microsoft Visual C++ 2005 Redistributable        notwendig                       
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148        notwendig                       
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148        notwendig                       
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022        notwendig                       
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17        notwendig                       
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218        notwendig                       
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        notwendig                       
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        notwendig                       
Microsoft® Office-Add-In for Moodle        notwendig                       
MockFlow Desktop        notwendig                       
Monkey Island 2: Special Edition        notwendig                       
Mozilla Firefox (3.6.13)        notwendig                       
Mozilla Thunderbird (3.1.4)        notwendig                       
Mp3tag v2.45a        notwendig                       
MSI Afterburner 1.0.0        notwendig                       
MSXML 4.0 SP2 (KB954430)        notwendig                       
MSXML 4.0 SP2 (KB973688)        notwendig                       
Native Instruments Absynth 4        notwendig                       
Native Instruments Battery 3        notwendig                       
Native Instruments Battery 3        notwendig                       
Native Instruments FM8        notwendig                       
Native Instruments Massive        notwendig                       
Native Instruments Pro-53        notwendig                       
Native Instruments Service Center        notwendig                       
Native Instruments Service Center        notwendig                       
NCsoft Launcher        unnötig                       
Need For Speed™ World        unnötig                       
Nero 9 Essentials        notwendig                       
Notepad++        notwendig                       
NVIDIA Display Control Panel        notwendig                       
NVIDIA Drivers        notwendig                       
NVIDIA PhysX        notwendig                       
NVIDIA Stereoscopic 3D Driver        notwendig                       
OpenAL        notwendig                       
OpenOffice.org 3.2        notwendig                       
Opera 10.10        notwendig                       
Pando Media Booster        unbekannt                       
PC Connectivity Solution        unnötig                       
Phase 5 HTML-Editor        notwendig                       
Pidgin        notwendig                       
PoiZone        notwendig                       
Portal: The First Slice        notwendig                       
PunkBuster Services        notwendig                       
Python 2.6.5        notwendig                       
QuickTime        notwendig                       
Realtek High Definition Audio Driver        notwendig                       
RippMe        notwendig                       
RocketDock 1.3.5        unnötig                       
Safari        notwendig                       
Sakura        notwendig                       
SampleTank FREE        unnötig                       
SAMSUNG Mobile Composite Device Software        notwendig                       
Samsung Mobile Modem Device Software        notwendig                       
SAMSUNG Mobile Modem Driver Set        notwendig                       
Samsung Mobile phone USB driver Drive Software        notwendig                       
SAMSUNG Mobile USB Modem 1.0 Software        notwendig                       
SAMSUNG Mobile USB Modem Software        notwendig                       
SAMSUNG USB Mobile Device Software        notwendig                       
SamsungConnectivityCableDriver        notwendig                       
Sawer        notwendig                       
Scribus 1.3.3.13        notwendig                       
ScummVM 1.0.0        notwendig                       
Sigel Professional Label Software SE        unnötig                       
Skype™ 4.2        notwendig                       
Sonik Synth 2 Free        notwendig                       
Sony DVD Architect 4.0        notwendig                       
Sony Media Manager 2.2        notwendig                       
Sony Vegas 7.0        notwendig                       
Steam        notwendig                       
Sun VirtualBox        notwendig                       
Syncrosoft Lizenz Kontrolle        unbekannt                       
The Secret of Monkey Island: Special Edition        notwendig                       
Tomb Raider: Underworld 1.1        notwendig                       
Toxic Biohazard        notwendig                       
Tropico 3 - Steam Special Edition        notwendig                       
Tropico 3: Absolute Power        notwendig                       
TrueCrypt        notwendig                       
TuxGuitar        unnötig                       
Tycoon City - New York        notwendig                       
Ubisoft Game Launcher        notwendig                       
Unreal Development Kit: 2010-01        notwendig                       
Visual C++ 8.0 Runtime Setup Package (x64)        notwendig                       
Visual Studio 2005 Tools for Office Second Edition Runtime        notwendig                       
VLC media player 1.0.5        notwendig                       
WavePad Sound Editor        unnötig                       
Winamp        notwendig                       
Winamp Anwendungserkennung        notwendig                       
Windosill        notwendig                       
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)        unnötig                       
Wings 3D 1.0.1        notwendig                       
WinRAR        notwendig                       
XMedia Recode 2.2.7.7        notwendig                       
Xvid 1.2.2 final uninstall        unbekannt                       
µTorrent        notwendig
ICh hab versucht es ordentlicher hinzukriegen, hat aber nich geklappt. Hätte es auch noch als Excel/Calc Tabelle...

markusg 12.12.2010 17:47
deinstaliere:
ABBYY FineReader

Adobe Reader 9
ersetzen:
Adobe - Adobe Reader herunterladen - Alle Versionen

bitte den mcafee security scan nicht mit instalieren.
öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus, internet, ebenfalls alle haken raus.
so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden.
unter allgemein, nur zertifizierte zusatzmodule verwenden anhaken.
unter update, auf instalieren stellen.
klicke übernehmen /ok

deinstaliere:
Bonjour
DivX
Exteel
foobar2000
Free M4a to MP3 Converter
GEAR driver installer
GNU
Grand Theft
GTA2
NCsoft Launcher
Need For Speed™
PC Connectivity
RocketDock
SampleTank
Sigel Professional Label Software
Skype™ öffnen, update klicken und version 5 drauf.
TuxGuitar
WavePad
bereinige dann dateien + registry
war genauso wie ichs wollte :-)

craep 12.12.2010 18:13
Alles klar, vielen Dank für deine intensive Hilfe.
Wäre es möglich diesen Thread zu löschen, er hilft ja eh keinem (man braucht ja eine individuelle Anleitung) und mir wäre es lieber wenn die ganzen Logs und Listen mit Infos über meinen Computer nicht öffentlich wären...


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:44 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19